DOUBLECUP LaaS Hides Malware in PNG Images

Executive Summary

A new Russian-speaking Loader-as-a-Service (LaaS) operation named DOUBLECUP is enabling cybercriminals to distribute malware using novel evasion techniques. Active since at least June 2026, DOUBLECUP employs steganography to hide malicious payloads within PNG image files. The attack chain, part of a "ClickFix" campaign, socially engineers victims into executing a command that extracts and runs malware from a PNG file cached by their browser. The service has been observed delivering the CountLoader malware and a previously undocumented Windows Remote Access Trojan (RAT) called DeviceManager. This new RAT uses the blockchain for its command-and-control (C2) infrastructure, making it highly resilient.

Threat Overview

The DOUBLECUP service provides malware distribution capabilities to other criminals. The attack begins when a victim is lured to a malicious website, often a convincing fake login page for a CRM platform like Salesforce or HubSpot. The site presents a fake verification prompt (e.g., a CAPTCHA) that instructs the user to copy a command and paste it into a terminal or command prompt to "verify" their session. This is a social engineering tactic known as a "ClickFix" attack.

The pasted command does not perform verification. Instead, it searches the local browser cache for a specific PNG image that was downloaded from the malicious site. This image appears benign but contains a hidden, encrypted malware payload. The script extracts and decrypts the payload directly in memory using the victim's public IP address as part of the decryption key. This fileless, in-memory execution makes the malware difficult for traditional antivirus software to detect.

Technical Analysis

The DOUBLECUP attack chain combines several clever techniques to evade detection:

1. Social Engineering: The attack relies on tricking the user into executing code themselves, bypassing many automated security controls. This is a form of T1204.002 - Malicious File, though in this case, it's a malicious command.
2. Steganography: The core of the technique is hiding the payload within a PNG file. This is a classic example of T1027.003 - Steganography. By hiding code in a common file type, it can bypass simple network content filters.
3. Execution: The malware is executed in memory after being extracted from the image, which aligns with T1059 - Command and Scripting Interpreter and aims to be fileless to evade AV scans.
4. Command and Control: The DeviceManager RAT uses "EtherHiding," querying the Ethereum or Polygon blockchain to retrieve its C2 server address. This makes the C2 infrastructure decentralized and highly resistant to takedowns. This is a sophisticated form of T1102.002 - Bidirectional Communication.

The delivered payloads, CountLoader and DeviceManager, provide the attacker with information stealing and remote access capabilities, respectively.

Impact Assessment

The DOUBLECUP LaaS lowers the barrier to entry for less sophisticated cybercriminals to conduct stealthy malware campaigns. The use of steganography and in-memory execution can bypass traditional endpoint security, while the blockchain-based C2 makes the resulting infections difficult to disrupt. A successful infection with the DeviceManager RAT gives an attacker full control over the victim's machine, leading to data theft, financial fraud, or the machine being used as a pivot point for further attacks into a corporate network. The targeting of CRM users suggests an aim to compromise business accounts, which can lead to larger business email compromise (BEC) schemes or data breaches.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for this activity using the following patterns:

Detection & Response

Detection:

1. Endpoint Monitoring (EDR): Use an EDR solution to monitor for suspicious command-line activity, especially PowerShell or shell commands interacting with browser cache directories or executing content from the clipboard. This aligns with D3FEND's Process Analysis.
2. Network Analysis: Monitor for and alert on outbound connections to public blockchain gateways from standard user workstations. This is an anomalous activity for most corporate environments. This uses D3FEND's Network Traffic Analysis.
3. YARA Scanning: Develop and use YARA rules to scan memory for strings and patterns associated with CountLoader and DeviceManager.

Response:

1. Isolate: Isolate any machine suspected of being compromised.
2. Block C2: If blockchain C2 is detected, block outbound access to the identified blockchain nodes at the firewall.
3. Credential Reset: Assume all credentials on the compromised machine have been stolen and initiate a full password reset for the user.

Mitigation

Strategic:

1. User Training: The primary defense against ClickFix attacks is user education. Train users to never, under any circumstances, paste commands from a website into a terminal or PowerShell window. This is a critical component of security awareness.
2. Application Control: Use application control solutions to prevent users from executing unauthorized scripts or commands. Restrict the use of PowerShell for standard users.

Tactical:

1. Attack Surface Reduction: Configure PowerShell to run in Constrained Language Mode for non-administrative users, which limits its ability to execute malicious code.
2. Clipboard Monitoring: Some advanced EDR tools can monitor and alert on suspicious clipboard operations, such as copying a command and immediately pasting it into a shell.